How severe is GHSA-74r7-3mjm-jc5v?

GHSA-74r7-3mjm-jc5v has a CVSS score of 6.5/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by GHSA-74r7-3mjm-jc5v?

GHSA-74r7-3mjm-jc5v affects the following packages: edumfa (PyPI). Ecosystems affected: PyPI.

How do I fix GHSA-74r7-3mjm-jc5v?

Update edumfa to 2.9.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-74r7-3mjm-jc5v is resolved across your whole dependency graph.

How do I detect GHSA-74r7-3mjm-jc5v in my PyPI dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for edumfa, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-74r7-3mjm-jc5v if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-74r7-3mjm-jc5v actively exploited in the wild?

No public exploit code has been indexed for GHSA-74r7-3mjm-jc5v yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-74r7-3mjm-jc5v published, and has it been updated?

GHSA-74r7-3mjm-jc5v was published on May 18, 2026 and was last updated on May 18, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐍

🐍 PyPI

Not in CISA KEV

MEDIUM severity

GHSA-74r7-3mjm-jc5v — edumfa

MEDIUM

GHSA-74r7-3mjm-jc5v is a medium-severity (CVSS 6.5) vulnerability in edumfa. A fix is available for edumfa — see the affected versions and patch details below.

eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check

Published

May 18, 2026

Updated

May 18, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of May 18, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐍edumfa

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Impact

If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased.

Patches

This, along with other issues, was fixed in eduMFA v2.9.1.

Workarounds

Limiting access to /validate/check to client applications (i.e. Shibboleth/FreeRADIUS) using an authorization policy with api_key_required or using e.g. the reverse proxy.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐍PyPI	`edumfa`	all versions	2.9.1`pip install --upgrade 'edumfa==2.9.1'`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for edumfa, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update edumfa to 2.9.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-74r7-3mjm-jc5v is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. ### Patches This, along with other issues, was fixed in eduMFA v2.9.1. ### Workarounds Limiting access to `/validate/check` to client applications (i.e. Shibboleth/FreeRADIUS) using an authorization policy with `api_key_required` or using e.g. the reverse proxy.

O3 Security · Impact-Aware SCA

Is GHSA-74r7-3mjm-jc5v in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works

GHSA-74r7-3mjm-jc5v — edumfa

Real-World Exposure

Description

Impact

Patches

Workarounds

Affected Packages

Detection & mitigation playbook

Detect

Fix

Workarounds

Frequently Asked Questions

Is GHSA-74r7-3mjm-jc5v in your dependencies?